gitsign verifies Git commit signatures by re‑encoding commit objects using go‑git's EncodeWithoutSignature before checking the signature, rather than verifying against the raw git object bytes. This behavior allows a crafted signature over a go‑git‑normalized form of a malformed commit—specifically one with duplicate tree headers—to pass verification while the actual git‑core representation resolves to a different tree. Consequently, an attacker can submit a commit that appears valid under gitsign verification but actually differs in content when viewed by git‑core, breaking the trust chain between the signed commit, the displayed commit content, and the logged object hash in Rekor. The weakness stems from CWE‑295 and CWE‑347.

sigstore's gitsign tool, versions prior to 0.16.0, on any platform where gitsign is used to verify Git commits or tags. Users of command‑line gitsign verify or gitsign verify‑tag are directly affected.

The CVSS score of 5.3 indicates moderate severity. Because the EPSS score is not available, the likelihood of exploitation cannot be quantified, but the vulnerability is not identified in CISA KEV. The attack requires an attacker to supply a malformed commit with duplicate tree headers that passes go‑git normalization, and then run gitsign verify against it. This could be executed locally on a compromised system or via a build pipeline that trusts gitsign to validate commits. Although no remote network‑facing vector is explicitly described, compromised or malicious build environments represent realistic scenarios. Therefore, organizations should consider the risk moderate and proceed with remediation promptly.